Privacy and shopper data

The two try-on modes handle shopper data differently. If you’re answering a privacy question or filling in a data-processing record, the distinction matters.

Real-time AR

The camera feed is processed on the shopper’s device. Frames are rendered against the 3D model in the browser and are not uploaded to TryOn.

Before the camera starts, the shopper is asked for consent, and the browser separately asks for camera permission. Both outcomes are recorded, so a declined prompt shows up in your dashboard rather than looking like a failure.

AI Swap

AI Swap works differently, and this is the part most often described incorrectly: the shopper’s photo is uploaded. It goes to the TryOn API, which forwards it to the processing engine that generates the result image. It does not stay on the device.

The shopper consents before the photo is selected, and can supply an existing photo or take a new one.

Note

Retention on the processing engine isn’t documented on this site — see your privacy policy and DPA for how long generated results and source photos are kept, and for the controller/processor split. Don’t quote a retention period from these docs; there isn’t one here to quote.

What the analytics events record

Every try-on interaction writes an analytics event carrying:

• An anonymous per-visit session ID and a persistent per-device visitor ID. Neither is derived from a customer account, an email address, or a name.
• The product and variant being tried on.
• App version and user agent, for diagnosing widget problems.
• Event-specific metadata — for example, how long a shopper tabbed away mid-session.

No customer name, email, address, or order data is attached to a try-on event. The visitor ID is what makes unique-visitor metering possible (see Billing) — it identifies a device across visits, not a person across your store.

Consent and permission outcomes

Consent is recorded separately for each mode, and a declined consent is a normal outcome rather than an error. Alongside it, the browser’s own camera decision is recorded — granted, denied, or blocked by a site policy before the shopper was ever asked. That last case is worth checking if AR sessions look unexpectedly low: a restrictive Permissions-Policy header on your storefront can block camera access outright.

GDPR

Try-on is built to operate under GDPR and collects only what’s needed to run the widget and report usage back to you. Because you’re the merchant of record on your own storefront, your privacy policy and DPA are the authoritative documents for your compliance record — including the processor chain for AI Swap, which involves the processing engine as well as TryOn.

Next

FAQ — quick answers to the questions merchants ask most.